United States Patent and Trademark Office 



UNITED STATES DEPARTMENT OF COMMERCE 
I nilid Stall-, Patent and Trademark Office 

Address: COMMISSIONER FOR PATENTS 



APPLICATION NO. 



FILING DATE 



FIRST NAMED INVENTOR 



ATTORNEY DOCKET NO. CONFIRMATION NO. 



10/630. !92 



07/30/2003 



23550 7590 02/11/2009 

HOFFMAN WARNICK LLC 
75 STATE STREET 
14TH FLOOR 
ALBANY, NY 12207 



Prasanna Amitabh 



CHA9200300I7I SI 



ROBINSON BOYCE, AKIBA K 



PAPER NUMBER 



NOTIFICATION DATE | DELIVERY MODE 
02/11/2009 ELECTRONIC 



Please find below and/or attached an Office communication concerning this application or proceeding. 

The time period for reply, if any, is set in the attached communication. 

Notice of the Office communication was sent electronically on above-indicated "Notification Date" to the 
following e-mail address(es): 

PIXX \)ininuiiications(n 'liolTmamvarnick.coin 



PTOL-90A (Rev. 04/07) 



l/ffflrC? nVrliUli Otfff Iff ids y 


Application No. 

10/630,392 


Applicant(s) 

AM I TAB H ET AL. 


Examiner 

AKIBA K. ROBINSON BOYCE 


Art Unit 

3628 





- The MAILING DATE of this communication appears on the cover sheet with the correspondence address — 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

Status 

1 )KI Responsive to communication(s) filed on 13 November 2008 . 
2a )^ This action is FINAL. 2b)D This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1-26 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) |EI Claim(s) 1-26 is/are rejected. 

7) 0 Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) Q The specification is objected to by the Examiner. 

10) D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

20 Certified copies of the priority documents have been received in Application No. . 

3.Q Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 



Attach ment(s) 

1) ^| Notice of References Cited (PTO-892) 4) □ Interview Summary (PTO-41 3) 

2) □ Notice of Draftsperson's Patent Drawing Review (PTO-948) Paper No(s)/Mail Date. . 

3) □ Information Disclosure Statement(s) (PTO/SB/08) 5 ) □ Notice of Informal Patent Application 

Paper No(s)/Mail Date . 6) □ Other: . 



PTOL-T26 d (Rev e 08-06r 



Office Action Summary 



Part of Paper No./Mail Date 20090202 



Application/Control Number: 10/630,392 
Art Unit: 3628 



DETAILED ACTION 



Page 2 



Status of Claims 

1 . Due to communications filed 1 1/13/08, the following is a final office action. 
Claims 1, 10 and 18 are amended. Claims 1-26 are pending in this application and 
have been examined on the merits. Due to the amendment filed 11/13/08, the previous 
rejection has been withdrawn, and the following rejection reflects claims as amended. 
Claims 1-26 are rejected as follows. 



Claim Rejections - 35 USC § 103 

2. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth 
in section 1 02 of this title, if the differences between the subject matter sought to be patented and the 
prior art are such that the subject matter as a whole would have been obvious at the time the invention 
was made to a person having ordinary skill in the art to which said subject matter pertains. Patentability 
shall not be negatived by the manner in which the invention was made. 
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3. Claims 1-25 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Breslin et al (US 2004/0098285 A1 ), and further in view of Jaskolski et al (US 
2003/0055684 A1). 

As per Claim 1 , Breslin et al discloses a customer relationship management 
(CRM) system that is accessible via a network, ([0009], core repository that manages, 
monitors and measures all data privacy assessments across an institution, [0030], using 
a distributed client/server architecture , w/[0031], client is a web-based browser 
application), comprising: 

- a user interface that provides distributed access for support providers to case 
information within the CRM system, the user interface that provides access to a 
customer case management page for viewing all cases opened for a given customer 
and a case summary page for viewing details of individual cases stored within the CRM 
system, ([0013], user interface that allows upper management to review risk exposure 
and compliance status, and [0077)], shows a user interface screen for providing the 
user with access to the collection, library, of data privacy materials that has been 
collected by the enterprise); 

- a case management system for managing customer cases, wherein the case 
management system includes a system for assigning cases to different tiers within a 
support provider hierarchy; ([0015], access levels for review of risk exposure and 
compliance) and 
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-a compliance tracking system that retrieves previously loaded customer 
compliance data from a database, ([0055], shows database can be consulted when 
system determines the compliance of the application with the laws and regulations of 
the jurisdictions in which the application operates); 

wherein the compliance data consists of information related to whether a 
customer has met certain required pre-set goals set by the CRM system, compares the 
compliance data for each customer with predetermined levels to determine customer 
compliance and provides a compliance indicator on the customer case management 
page, ([0012], shows compliance with applicable sate and Federal laws is assessed and 
once risk is acknowledged, a plan for reducing the risk or bringing the groups 
procedures into compliance can be formulated, and progress towards compliance can 
be tracked, and [0069], compliance indicator is displayed, in this case comparing is 
obvious since compliance with applicable state and Federal laws requires some type of 
comparison between current applications and the state and Federal laws). 

It would have been obvious to one of ordinary skill in the art at the time of the 
applicant's invention to compare compliance data for each customer with predetermined 
levels with the motivation of determining current compliance data. 

Breslin et al fails to disclose allowing the customer to access case information, 
and , wherein the customers and the support providers are separate and distinct 
institutions, however does disclose that an application could have contact with both 
customer and employee data in [0047]. 
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However, Jaskolski et al discloses A participant in the system may be the patient 
himself, or skilled and unskilled staff as shown in [0039]. It therefore would be obvious 
to combine the teachings of Breslin et al and Jaskolski et al to disclose allowing the 
customer to access case information, and , wherein the customers and the support 
providers are separate and distinct institutions. 

It would have been obvious to one of ordinary skill in the art at the time of the 
application to disclose allowing the customer to access case information, and , wherein 
the customers and the support providers are separate and distinct institutions with the 
motivation of showing that two individual parties are able to access case information. 

As per Claim 2, Breslin et al further discloses the CRM system of claim 1 , 
wherein the case management system further includes a notification system for 
automatically generating emails when a new case is opened, ([0040], email notifying the 
person of the assignment and the responsibilities associated therewith) 

As per Claim 3, Breslin et al further discloses the CRM system of claim 1 , 
wherein the case management system further includes a system that allows support 
providers to check-in/check-out cases, ([0040], when assignment is made, input screen 
shows date on which the assignment was accepted and updates the applicable 
database to record the assignment , [0045], shows alternate assignments, which makes 
checking out cases obvious since when re-assigning to an alternate application, the 
case must be checked out for the first application). 
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It would have been obvious to one of ordinary skill in the art at the time of the 
applicant's invention to check-out cases with the motivation of ending processing of a 
first case. 

As per Claim 4, Breslin et al further discloses the CRM system of claim 1 , 
wherein the case management system further includes a set of business rules that 
determines what level of case information is to be made available to customers and 
support providers. ([0014], higher level managers have broader access than lower level 
managers, which is based on seniority) 

As per Claim 5, Breslin et al further discloses the CRM system of claim 1 , 
wherein the case management system further includes a set of business rules that 
determines how cases are to be assigned and escalated among the different tiers of 
support providers. ([0014], cases are assigned based on seniority) 

As per Claim 6, Breslin et al further discloses the CRM system of claim 1 , 
wherein the compliance tracking system includes a set of business rules that 
determines a compliance risk level for each customer. ([0014], ability to access risk 
assessment data) 

As per claims 7-8, 12, 17 and 24-25 , Breslin et al discloses mostly all of the 
limitations including wherein the portal page provides access to a customer case 
management page for viewing all cases opened for a given customer and a case 
summary page for viewing details of individual cases as shown in [0004], where a 
summary or compiled data is shown. 
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Breslin et al also discloses wherein the compliance risk level is selected from the 
group consisting of: in compliance, in danger of becoming out of compliance, and out of 
compliance in [0012], where compliance is shown with applicable sate and Federal laws 
is assessed and once risk is acknowledged, a plan for reducing the risk or bringing the 
groups procedures into compliance can be formulated, and progress towards 
compliance can be tracked. 

Breslin et al also discloses and also wherein the compliance indicator comprises 
a traffic light indicator having a green, yellow, and red light as shown in [0073], where 
green, amber and red are shown as compliance indicators. In this case, amber 
represents yellow. 

As per Claim 9, Breslin et al further discloses the CRM system of claim 6, 
wherein the compliance tracking system includes a system for creating a new customer 
case when a predetermined compliance risk level occurs (abstract, lines 18-24, If a risk 
exists, a plan for reducing the risk or bringing the application into compliance can be 
formulated, and progress towards compliance can be tracked, w/[0010], shows a six- 
step system to bring status into compliance, which includes employing automated 
questionnaires, which is a step involved in processing of assessment for each 
application, which therefore suggests that the process is done for new applications 
since as shown in [0033], the person is just assigned to a particular application for the 
purpose of review/assessment). 

It would have been obvious to one of ordinary skill in the art at the time of the 
applicant's invention to create a new customer case when a predetermined compliance 
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risk level occurs with the motivation of creating a new case that can be re-assessed for 
compliance. 

As per Claim 10, Breslin et al further discloses a method for providing customer 
relationship management (CRM) via a computer network, comprising: 

-providing a network node that allows distributed access, ([0009], core repository that manages, 
monitors and measures all data privacy assessments across an institution, [0030], using a 
distributed client/server architecture , w/[003 1], client is a web-based browser application); 
-opening a new case within the CRM system when a customer issue occurs; 

(abstract, lines 1 8-24, If a risk exists, a plan for reducing the risk or bringing the 

application into compliance can be formulated, and progress towards compliance can 

be tracked, w/[0010], shows a six-step system to bring status into compliance, which 

includes employing automated questionnaires, which is a step involved in processing of 

assessment for each application, which therefore suggests that the process is done for 

new applications since as shown in [0033], the person is just assigned to a particular 

application for the purpose of review/assessment). 

It would have been obvious to one of ordinary skill in the art at the time of the 

applicant's invention to create a new customer case when a predetermined compliance 

risk level occurs with the motivation of creating a new case that can be re-assessed for 

compliance. 

- adding the new case to a customer case management page; ([0054], add 
button adds jurisdictions that are applicable to the application under review) 

- displaying a compliance indicator when the customer case management page 
is viewed; ([0069], compliance indicator is displayed); 



Application/Control Number: 10/630,392 Page 9 

Art Unit: 3628 

wherein the compliance indicator is based on information related to whether a 
customer has met certain required pre-set goals set by the CRM system, ([0012], shows 
compliance with applicable sate and Federal laws is assessed and once risk is 
acknowledged, a plan for reducing the risk or bringing the groups procedures into 
compliance can be formulated, and progress towards compliance can be tracked); 

- assigning the new case to a first tier support provider; ([0033], lines 1-8, 
assignment to the manager in charge of the application, as this is the person in the 
organization with the most intimate knowledge about the current state of the operation 
of the application at any given time) 

The following is suggested by Breslin et al since access levels are assigned 
based on seniority or management status as shown in [0015], and higher management 
is shown to have more knowledge as shown in [0033]: 
-determining if the first tier support provider can handle the new case; and 
-escalating the new case to a second tier support provider if the first tier support 
provider cannot handle the case. 

It would have been obvious to one of ordinary skill in the art at the time of the 
applicant's invention to determine if the first tier support provider can handle the new 
case, and escalate the new case to a second tier support provider if the first tier support 
provider cannot handle the case with the motivation of providing a case for assessment 
to someone with more knowledge. 

Breslin et al fails to disclose for access for both customers and support providers 
to a CRM System, wherein the customers and the support providers are separate and 
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distinct institutions, however does disclose that an application could have contact with 
both customer and employee data in [0047]. 

However, Jaskolski et al discloses A participant in the system may be the patient 
himself, or skilled and unskilled staff as shown in [0039]. It therefore would be obvious 
to combine the teachings of Breslin et al and Jaskolski et al to disclose allowing the 
customer to access case information, and , wherein the customers and the support 
providers are separate and distinct institutions. 

It would have been obvious to one of ordinary skill in the art at the time of the 
application to disclose allowing the customer to access case information, and , wherein 
the customers and the support providers are separate and distinct institutions with the 
motivation of showing that two individual parties are able to access case information. 

As per Claim 11. Breslin et al further discloses the method of claim 1 0, wherein the 
network node comprises a web portal. ([0035], application portal) 

As per Claim 13, Breslin et al further discloses the method of claim 10, comprising the 
further step of generating email notifications according to a set of business rules, 
([0040], email notifying the person of the assignment and the responsibilities associated 
therewith) 
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As per Claim 14, Breslin et al discloses having an assigned support provider 
check out the case from the CRM system. ([0043], outside support providers). 

As per Claim 15, Breslin et al discloses, wherein the step of opening a new case 
is performed by the customer at the network node, ([0009], core repository that 
manages, monitors and measures all data privacy assessments across an institution, 
[0030], using a distributed client/server architecture , w/[0031], client is a web-based 
browser application); 

As per Claim 16, Breslin et al further discloses, wherein the step of opening a 
new case is initiated automatically when the customer is out of compliance. ([0046], 
assessment is accomplished automatically). 

As per Claim 18, Breslin et al further discloses a program product stored on a 
recordable medium that provides a customer relationship management (CRM) tool via 
the web, comprising: 

-a portal page for providing distributed access on the web, ([0035], application portal) 

-a customer management module for managing customer cases and for assigning 
cases to different tiers within a support provider hierarchy, ([0033], lines 1-8, 
assignment to the manager in charge of the application, as this is the person in the 
organization with the most intimate knowledge about the current state of the operation 
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of the application at any given time and ([0015], access levels for review of risk 
exposure and compliance) and 

-a customer compliance module retrieves previously loaded customer compliance data 
from a database, ([0055], shows database can be consulted when system determines 
the compliance of the application with the laws and regulations of the jurisdictions in 
which the application operates); 

wherein the compliance data consists of information related to whether a 
customer has met certain required pre-set goals set by the CRM system, compares the 
compliance data for each customer with predetermined levels to track customer 
compliance and displays a compliance indicator on customer case management page, 
([0012], shows compliance with applicable sate and Federal laws is assessed and once 
risk is acknowledged, a plan for reducing the risk or bringing the groups procedures into 
compliance can be formulated, and progress towards compliance can be tracked, and 
[0069], compliance indicator is displayed, in this case comparing is obvious since 
compliance with applicable state and Federal laws requires some type of comparison 
between current applications and the state and Federal laws). 

It would have been obvious to one of ordinary skill in the art at the time of the 
applicant's invention to compare compliance data for each customer with predetermined 
levels with the motivation of determining current compliance data. 
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Breslin et al fails to disclose access for customers and support 
providers to case information within the CRM tool, wherein the customers and the 
support providers are separate and distinct institutions however does disclose that an 
application could have contact with both customer and employee data in [0047]. 

However, Jaskolski et al discloses a participant in the system may be the patient 
himself, or skilled and unskilled staff as shown in [0039]. It therefore would be obvious 
to combine the teachings of Breslin et al and Jaskolski et al to disclose access for 
customers and support providers to case information within the CRM tool, wherein the 
customers and the support providers are separate and distinct institutions. 

It would have been obvious to one of ordinary skill in the art at the time of the 
application to disclose access for customers and support providers to case information 
within the CRM tool, wherein the customers and the support providers are separate and 
distinct institutions with the motivation of showing that two individual parties are able to 
access case information. 

As per Claim 19, Breslin et al further discloses the program product of claim 18, 
wherein the case management module further includes a notification system for 
automatically generating emails when a new case is opened, ([0040], email notifying the 
person of the assignment and the responsibilities associated therewith) 



As per Claim 20. Breslin et al further discloses the program product of claim 18, 
wherein the case management module further includes a system that allows support 
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providers to check-in/check-out cases, ([0040], when assignment is made, input screen 
shows date on which the assignment was accepted and updates the applicable 
database to record the assignment , [0045], shows alternate assignments, which makes 
checking out cases obvious since when re-assigning to an alternate application, the 
case must be checked out for the first application). 

As per Claim 21 , Breslin et al further discloses the program product of claim 18, wherein 
the case management module further includes a set of business rules that determines 
what level of case information is to be made available to customers and support 
providers. ([0014], higher level managers have broader access than lower level 
managers, which is based on seniority) 

As per Claim 22, Breslin et al further discloses the program product of claim 18, wherein 
the case management module further includes a set of business rules that determines 
how cases are to be assigned and escalated among the different tiers of support 
providers. ([0014], cases are assigned based on seniority) 

As per Claim 23, Breslin et al further discloses the program product of claim 18, wherein 
the compliance tracking module includes a set of business rules that determines a 
compliance risk level for each customer. ([0014], ability to access risk assessment data) 



As per Claim 26. The program product of claim 23, wherein the compliance tracking 
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module includes a system for creating a new customer case when a predetermined 
compliance risk level occurs, (abstract, lines 18-24, If a risk exists, a plan for reducing 
the risk or bringing the application into compliance can be formulated, and progress 
towards compliance can be tracked, w/[0010], shows a six-step system to bring status 
into compliance, which includes employing automated questionnaires, which is a step 
involved in processing of assessment for each application, which therefore suggests 
that the process is done for new applications since as shown in [0033], the person is 
just assigned to a particular application for the purpose of review/assessment). 

It would have been obvious to one of ordinary skill in the art at the time of the 
applicant's invention to create a new customer case when a predetermined compliance 
risk level occurs with the motivation of creating a new case that can be re-assessed for 
compliance. 

Response to Arguments 

4. Applicant's arguments with respect to claims 1-26 have been considered but are 
moot in view of the new ground(s) of rejection. 



Conclusion 

5. Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL. See M PEP 
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§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Akiba K Robinson-Boyce whose telephone number is 
571-272-6734. The examiner can normally be reached on Monday-Friday 9am-5:30pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, John Hayes can be reached on 571-272-6708. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 
Information regarding the status of an application may be obtained from the 
•Patent Application Information Retrieval (PAIR) system, Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through Private PAIR only. For 
more information about the PAIR system, see http://pair-direct.uspto.gov. Should you 
have questions on access to the Private PAIR system, contact the Electronic Business 
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Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO 
Customer Service Representative or access to the automated information system, call 
800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the receptionist whose telephone number is 703-305- 
3900. 

A. R. B. 

February 10, 2009 



/Akiba K Robinson-Boyce/ 
Primary Examiner, Art Unit 3628 



